name: CI

on:
  push:
    branches: ["main"]
  pull_request:
  schedule:
    - cron: "34 6 * * 5"

jobs:
  test:
    strategy:
      matrix:
        os: [ubuntu-26.04, macos-latest]
        rust: [stable]
        include:
          - os: ubuntu-26.04
            rust: beta

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
      - run: cargo check --all-targets
      - run: cargo check -p oxish --no-default-features --features aws-lc
      - run: cargo test --features graviola,aws-lc -- --include-ignored

  msrv:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: 1.85.0
      # aws-lc-rs has a lower MSRV than graviola, so we use it to test our MSRV
      - run: cargo check -p oxish --no-default-features --features aws-lc --bins

  fips:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - run: cargo check -p oxish --no-default-features --features aws-lc-fips

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          components: rustfmt, clippy
      - run: cargo fmt --all -- --check
      - run: cargo clippy --all-targets --all-features -- -D warnings

  docs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      # use nightly to mirror docs.rs
      - uses: dtolnay/rust-toolchain@nightly
      - name: cargo doc
        run: cargo doc --locked --all-features --no-deps --document-private-items
        env:
          RUSTDOCFLAGS: -Dwarnings

  coverage:
    runs-on: ubuntu-26.04
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: taiki-e/install-action@cargo-llvm-cov
      - run: cargo llvm-cov --workspace --lcov --output-path lcov.info -- --include-ignored
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          fail_ci_if_error: true

  semver:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Check semver
        uses: obi1kenobi/cargo-semver-checks-action@v2

  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: EmbarkStudios/cargo-deny-action@v2